The setup:

  • A windows workstation with Full admin rights.
  • A very restrictive http proxy, which, however, accepts connection towards port 80 and port 443 only.
  • A linux box on the internet I have complete control of.

Currently, what I do, which is working:

  • The linux box run sshd, listening on port 443.
  • In putty, I can connect to the linux box simply by configuring in the proxy configuration panel the proxy as an HTTP proxy.

What I would like to achieve:

Run a browser, on my Windows box and, by using some kind of ssh tunnel, browse the web without any limitations.

I believe this is called proxy bouncing, or something like this. But I must admit, that I am a bit lost.

From what I understood, I would have to configure a tunnel into putty, listening on port 8889 on the windows box for example. I would then be able to configure the browser to use a proxy located at localhost:8889

The moment where things are becoming blurry is now.

On the linux box, I would have to configure a ProxyCommand in the SSH config file or something like that to do Port Forwarding ? In addition, would I have to run a proxy like squid on the linux box ? Some kind of tutorial I found describe a setup with Apache:

Or am I completly in the wrong direction and do I have to run ProxyTunnel both on the windows and linux box ?

Thanks for your help.

Edit: Actually, the question is more: What do I have to do on the linux side of the tunnel

6 Answers 6


There are two parts to getting this to work, so I'll address them seperately.

Connecting to your Server:

As you've mentioned that all you can talk to is a proxy on 443 and 80, you'll need to tunnel your SSH connection out through the proxy. You do that by telling Putty to use the proxy server to connect. Under the 'proxy' menu. Select HTTP and then enter the details for the corporate proxy.

From your post, it seems like you've got the connection working fine.

Configure Putty to Create a SOCKS proxy on the local machine

Both putty and OpenSSH support opening a SOCKS proxy. For OpenSSH you'd use:

ssh -D <port>

And then point your browser at that port. In putty you create a 'dynamic' port forward. You'll find it under the Tunnels menu. Enter your desired listening port and then enter anything you like as a destination (it gets ignored for dynamic forwards). You can then point your browsers proxy settings at that localhost:<port> and it should work.

For more information, the relevant part of the putty documentation is at http://tartarus.org/~simon/putty-snapshots/htmldoc/Chapter3.html#using-port-forwarding.

As others have posted you may not want to circumvent the corporate filtering though as it's not something you may want to explain :).

  • The name of the menu in putty is Tunnels actually.
    – David
    Jul 30, 2009 at 14:38
  • I understand first part (which is already working indeed) and second part. But: I don't get how it will work on the linux side. I mean, what the ssh server will do with the packets directed to a proxy ? Don't I have to configure a proxy on the linux box ? At the end, how will the http request be forwarded to the web site I am trying to contact?
    – David
    Jul 30, 2009 at 15:20
  • As long as you haven't disabled it, the OpenSSH server will handle that for you, no additional config should be needed.
    – Frenchie
    Jul 30, 2009 at 15:26
  • Thanks, it workss actually, but I don't get how, and that is what annoy me.
    – David
    Jul 30, 2009 at 15:29
  • The functionality is built directly into the SSH server itself. When you dynamically forward, your browser is effectively talking to the remote sshd process across the tunnel. The remote sshd makes the requests on your behalf and then sends the results back. Nothing too fancy really :)
    – Frenchie
    Jul 30, 2009 at 15:33

With ssh you can set up "dynamic port forwarding". See http://www.panix.com/~ruari/censorship.html for instructions. Basically you just set a port on your local machine which looks like a SOCKS5 proxy. Then configure your browser to use localhost:port as the proxy.

I would think twice before doing such a thing. In some environments, such bypassing of corporate security is grounds for dismissal.

  • Yes, especially when it becomes obvious because your computer is the largest source of viruses on the network...
    – Ernie
    Jul 30, 2009 at 16:06

With normal port forwarding you would only be able to browse one site that way.

If you can edit your local proxy settings (which I doubt you can) then you could run a proxy on the SSH server end and port-forward to that.

Some SSH clients and servers support lower level VPN like arrangements, but unless you have full admin control (which I'm guessing you don't as your description implies a very locked down environment) .

One solution would be to use port-forward to gain access to a machine at the remote end that is running VNC or RDC or similar. Once you have remote control over that machine you can browse using it, though this will be slower of course.

  • Actually, I can edit my local proxy settings, I also have local full admin control.
    – David
    Jul 30, 2009 at 14:36
  • In that case run a proxy on your Linux box, banu.com/tinyproxy for example which if you run Debian you find in the "tinyproxy" package, tunnel the port it listens on (8888 is common) over your SSH link, and set your browser to use that<port> as the HTTP proxy. Jul 30, 2009 at 15:20
  • A warning though: if you are doing this to get around an employers restrictions then you could fact the sack if you are spotted as this would be considered hacking around their security. Depending on your place of work you may open yourself to more serious accusations too (some places need to control external access from internal workstations for regulatory reasons, so you could be breaking the law not just breaking company rules). Jul 30, 2009 at 15:23

I think set up a local ssh tunnel should work well for you:

  1. set up the http proxy on the linux box at port xxxx
  2. connect the linux box with a ssh local tunnel, the ssh client command would like:

    ssh -L 8899: user@remote -p 443

putty may similar but use dialog.


You may be unfortunate enough to actually be under a Deep Packet Inspection router, in which case your SSH traffic over ANY port would be discarded.

The solution to THAT problem is STunnel in combination with SSH.

An easy to set up and use proxy I personally use is privoxy.org.


This old but good lifehacker article has very user friendly tutorial on how to do this in with Windows. PLUG_ALERT: Here is another tutorial, written by, well, me :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.